Privacy Policy

This policy covers personal data we handle as a controller, including data about:

Visitors to our website at compos.co.uk.
People who create a Compos account, start a trial, or subscribe.
People who contact us for sales or support.

It does not cover personal data that flows through your own Compos site (your visitors, form submissions, customers). For that data you are the controller and we act as your processor under the DPA.

You give us:

Account Data - Name, email, password, and business details.
Billing Data - Billing name and address, and payment details (handled by our payment processor. We do not store full card numbers).
Knowledge Base And Content - The business information and content you put into the service (this may include personal data you choose to provide).
Support Data - Anything you send us when you contact us.

We collect automatically:

Usage Data - How you use the service and our website (pages, features, actions, credit usage), device and browser information, and IP address.
Cookies And Similar Technologies - See clause 6.

From third parties:

Integrations You Connect - Where you connect Google or other services through the Hub, we receive data from those services (for example, Search
Console and Analytics metrics, and read only Google Business Profile information such as reviews and hours).

Purpose | Lawful Basis (UK/EU GDPR)
Create and run your account, provide the service | Performance of a contract
Take payment, manage subscriptions and credits | Performance of a contract, legal obligation (tax / accounting)
Provide support and respond to enquiries | Performance of a contract, legitimate interests
Operate AI features (Cleo) and integrations you use | Performance of a contract

Keep the service secure, prevent fraud and abuse | Legitimate interests
Improve and develop the service | Legitimate interests
Send service messages (e.g. billing, security) | Performance of a contract, legitimate interests
Send marketing (where applicable), Consent, or legitimate interests, with an opt-out in every message | Comply with legal obligations

Where we rely on legitimate interests, we have balanced those against your rights. You can ask us about this at hello@compos.co.uk.

When you use Cleo or other AI features, the content needed to fulfil your request, for example, your prompts, Knowledge Base entries, and relevant page content, is processed by AI providers through the Compos Hub to generate the output you asked for.

We use these providers to deliver the service and put appropriate contractual protections in place.

We do not use the AI to make decisions that produce legal or similarly significant effects about individuals.

We share personal data only as needed to run the service:

Service Providers / Sub Processors: Hosting, payment processing, AI providers, email delivery, analytics, and support tools.

They may process data only on our instructions.

Integration providers you connect, for example:

Google and review providers, where you choose to use them.
Professional advisers, auditors, and authorities, where required by law or to protect our rights.
A buyer or successor. If we reorganise, merge, or sell our business, on appropriate terms.

We do not sell your personal data.

We use cookies and similar technologies for essential functions, and (with your consent where required) for analytics and preferences. You can manage non-essential cookies through our cookie banner and your browser settings.

Where we transfer personal data outside the UK or EEA, we rely on an adequacy decision or appropriate safeguards, such as the UK International Data Transfer Agreement / Addendum or the EU standard contractual clauses, and take additional measures where needed. You can ask us for a copy of the relevant safeguard at legal@compos.co.uk.

We keep personal data only as long as needed:

Account And Content Data - For as long as your account is active, then for a limited period afterwards before deletion or anonymisation, unless we must keep it longer.

Billing Records - For the period required by tax and accounting law.

Support And Usage Data - For as long as needed for the purpose, then deleted or anonymised.

Subject to the law that applies to you, you have the right to: Access your data, have it corrected, have it erased, restrict or object to processing, data portability, and, where we rely on consent, to withdraw consent at any time. You can exercise these by emailing hello@compos.co.uk. We will respond within the time the law requires (usually one month).

If you are in the UK, you can complain to the Information Commissioner's Office (ico.org.uk). If you are in the EEA, you can complain to your local supervisory authority. We would appreciate the chance to address your concern first.

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, and monitoring, align with the measures in the DPA. No system is perfectly secure, but we work to protect your data and to respond promptly to any incident.

The service is not directed to children under 18, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact legal@compos.co.uk and we will delete it.

We may update this policy. We will post the updated version with a new effective date and, for material changes, notify you (for example, by email or in product notice).